# Todo 3 parent-capability authority decision

## Decision

Extend approved option B upward:

- A caller-held, identity-bound profile parent directory descriptor is the
  namespace authority.
- The bootstrap pathname is used only to acquire that capability. It is never
  claimed to stay attached or atomic after acquisition.
- All legitimate initializer, store, inventory, and repair operations
  cooperate on the parent/customer capability locks.
- A same-UID process that mutates names while ignoring those locks is an
  authority compromise, not a race the product can prevent with POSIX path
  checks.

## Consequences

- Remove support for publishing into a pre-existing empty destination.
- The pinned profile parent capability is the authority root; use a fixed
  namespace prefix for its marker and flat opaque-customer files.
- Publish the complete authority marker from an unnamed `O_TMPFILE` inode by
  descriptor (`linkat(..., AT_EMPTY_PATH)`) to an absent fixed marker name.
- Do not create or publish a stage directory.
- Eliminate exchanged-directory cleanup, stage `rmdir`, and the unavoidable
  `mkdir`-to-first-open ownership gap.
- Concurrent legitimate initializers serialize; one publishes and the rest
  return typed already-initialized.
- Repair uses an atomic replacement file under the pinned customer namespace,
  not in-place `ftruncate` of a descriptor whose name can be substituted.
- Lock-file canonical bytes, size, and digest are bound and revalidated under
  lock.
- Post-operation identity mismatch is a typed authority-compromise incident;
  it is never reported as an ordinary retryable failure or success.

## Threat boundary

Mode, owner, link, inode, schema, inventory, and history validation still
detect accidental or hostile drift. The implementation does not falsely claim
that advisory locks or open descriptors prevent an equally privileged process
from renaming names behind them.

This remains a default-OFF, local profile-owned authority design. Todo 12 must
seal the parent capability binding before deployment.